Has anyone looked at the issue of whether PHI may be disclosed to the sponsor's independent auditor for FAS 106 purposes?

My initial though is that this disclosure of PHI is not covered by any of the exemptions and would not be permitted under the HIPAA privacy rules. Also, not being an auditor, I don't know why summary or de-identified health information would not be sufficient for this purpose.

Any thoughts?

I'm not an auditor either but I think de-identified information should be sufficient.